giles 984ef9c65e Fix session security: clear stale sessions after DB rebuild ...

Two issues fixed:
- Sessions with uid but no grant_token (legacy or corrupt) were not
  validated at all, allowing a user to be logged in as whoever got
  their old numeric user ID after a DB rebuild
- DB errors during grant verification silently kept stale sessions
  alive; now treated as invalid to fail-safe

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-02-26 12:17:53 +00:00

11 KiB

Raw Blame History

View Raw